Converting Rail’s RESTful Authentication to PHP

A few months back we were rebuilding an existing site; the mandate was to use PHP for the upcoming release, but the existing site used Ruby on Rail’s RESTful Authentication gem to encrypt user passwords against a unique salt. Each user had both an encrypted password and a salt value that was being updated every time the user successfully logged in. Pretty smart.

Our problem was that we had to re-create the hashing of the user’s password so existing users could log into the site using their old password. With the code below, we are able to hash the user’s entered password in the same way that the Rails app did, allowing authentication to function properly in the new application. Fortunately the existing application used the default hashing method (we didn’t have access to the old site’s source code), so it was just a matter of digging around GIT to understand how the hashing process worked.

<?php
// $salt variable as retrieved from user's row based on supplied email address
$salt = '36493cef361b8b180863fe3e2685473f676359df';

$password = $_POST['password'];

//NOTE: this assumes a default Restful Auth setup
$password = sha1('--' . $salt . '--' . $password . '--');

//supplied password should now match encrypted database value if entered correctly
?>

Web Services and PHP – SOAP vs XML-RPC vs REST

In a typical web surfing scenario, a visitor visits a website and use the functionality provided by that particular website.HTTP request is send to server from web browsers and server responses are translated by browser to display the desired result of the visitor. 

But, this scenario has been changed in the recent days. You don’t need to visit the particular website to use their service and functionality if they are providing web services. Web services are set of platform independent exposed APIs(functions) which can be used used from remote server over the Internet. There are basically two parties involved in this, one which provides a set of exposed APIs and the another one ,commonly know as web services consumers,is the party which uses the functionality and services provided by web services providing party.

There are different method for providing web services but the most common are SOAP, XML-RPC and REST .

SOAP

SOAP was the acronym of Simple Object Access Protocal but this acronym was dropped in the version of 1.2 of SOAP. It is method for exchanging XML based message over the Internet for providing and consuming web services. SOAP message are transferred forming the SOAP-Envelope.You can view the typical SOAP Message articture from here. SOAP is widely criticized for it’s design complexity.

In PHP 5, there is built-in extension for the providing and consuming web services. But, I personally prefer Nusoaptoolkit of PHP for providing and consuming web services using SOAP in PHP.

XML-RPC

XML-RPC (remote procedure call) another way of providing and consuming web services. It uses XML to encode and decode the remote procedure call along with it’s parameter. Compared to the articture of SOAP, it has simpler architecture. You can even define data type of parameters of procedure in XML-RPC. 

In PHP, there is extension which contain various functions for facilating XML-RPC request and response. But the functions xmlrpc_encode_request() and xmlrpc_decode_request() available in PHP is very useful for when it comes to encode and decode XML-RPC request and response.

REST

Representational State Trasfer(REST) is comparatively simpler method for providing and consuming web services. Nowadays, this method is becoming popular in the arena of web services. Unlike above two method, it is not necessary to use XML as a data interchange format in REST. REST architecture is basically focused on two things : Resources and Interface.RESTful  is another term to define REST web services .

Resources are application’s state and functionality which is represented by a unique URL. The resources share a uniform interface to transfer the state between the client and server.

For example the URL, http://example.com/product/11 can be a resource.Suppose, GET method is used to retrieve product detail from that URL, POST method is used to modify the production information and DELETE method can be used to delete the product from the same URL. Here, the HTTP methods works as a interface to access the resources.

Talking about PHP, the format of information(representation) returned can be in XML, JSON or even in HTML format. DOM functions, SimpleXML functions and JSON functions comes handy when you are handling RESTful interfaces in PHP.